Skip to content

Commit 0929866

Browse files
yadvryadvr
authored
server: ssh-keygen in PEM format and reduce main systemvm patching script (#3333)
On first startup, the management server creates and saves a random ssh keypair using ssh-keygen in the database. The command does not specify keys in PEM format which is not the default as generated by latest ssh-keygen tool. The systemvmtemplate always needs re-building whenever there is a change in the cloud-early-config file. This also tries to fix that by introducing a stage 2 bootstrap.sh where the changes specific to hypervisor detection etc are refactored/moved. The initial cloud-early-config only patches before the other scripts are called. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1 parent e86f671 commit 0929866

11 files changed

Lines changed: 272 additions & 247 deletions

File tree

‎.travis.yml‎

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -99,28 +99,30 @@ env:
9999
smoke/test_volumes
100100
smoke/test_vpc_redundant
101101
smoke/test_vpc_router_nics
102-
smoke/test_vpc_vpn
103-
smoke/misc/test_deploy_vm
102+
smoke/test_vpc_vpn"
103+
104+
- TESTS="smoke/misc/test_deploy_vm
104105
smoke/misc/test_escalations_templates
105106
smoke/misc/test_vm_ha
106-
smoke/misc/test_vm_sync"
107-
108-
- TESTS="component/find_hosts_for_migration
107+
smoke/misc/test_vm_sync
108+
component/find_hosts_for_migration
109109
component/test_acl_isolatednetwork_delete
110110
component/test_acl_listsnapshot
111111
component/test_acl_listvm
112-
component/test_acl_listvolume
113-
component/test_acl_sharednetwork"
114-
115-
- TESTS="component/test_allocation_states
116-
component/test_acl_sharednetwork_deployVM-impersonation
117-
component/test_affinity_groups_projects
118-
component/test_cpu_domain_limits
119-
component/test_cpu_limits"
120-
121-
- TESTS="component/test_cpu_max_limits
122-
component/test_cpu_project_limits
123-
component/test_deploy_vm_userdata_multi_nic
112+
component/test_acl_listvolume"
113+
114+
- TESTS="component/test_acl_sharednetwork
115+
component/test_acl_sharednetwork_deployVM-impersonation"
116+
117+
- TESTS="component/test_affinity_groups_projects
118+
component/test_allocation_states"
119+
120+
- TESTS="component/test_cpu_domain_limits
121+
component/test_cpu_limits
122+
component/test_cpu_max_limits
123+
component/test_cpu_project_limits"
124+
125+
- TESTS="component/test_deploy_vm_userdata_multi_nic
124126
component/test_egress_fw_rules
125127
component/test_invalid_gw_nm
126128
component/test_ip_reservation
@@ -129,16 +131,18 @@ env:
129131
- TESTS="component/test_memory_limits
130132
component/test_mm_domain_limits
131133
component/test_mm_max_limits
132-
component/test_mm_project_limits
133-
component/test_network_offering
134+
component/test_mm_project_limits"
135+
136+
- TESTS="component/test_network_offering
134137
component/test_non_contiguous_vlan
135138
component/test_persistent_networks"
136139

137140
- TESTS="component/test_project_limits
138141
component/test_project_configs
139142
component/test_project_usage
140-
component/test_project_resources
141-
component/test_regions_accounts
143+
component/test_project_resources"
144+
145+
- TESTS="component/test_regions_accounts
142146
component/test_routers
143147
component/test_snapshots
144148
component/test_stopped_vm"

‎plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1362,7 +1362,7 @@ private boolean checkOvsNetwork(final String networkName) {
13621362
}
13631363

13641364
public boolean passCmdLine(final String vmName, final String cmdLine) throws InternalErrorException {
1365-
final Script command = new Script(_patchScriptPath, 30 * 1000, s_logger);
1365+
final Script command = new Script(_patchScriptPath, 300 * 1000, s_logger);
13661366
String result;
13671367
command.add("-n", vmName);
13681368
command.add("-c", cmdLine);

‎plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartCommandWrapper.java‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -125,9 +125,14 @@ public Answer execute(final StartCommand command, final LibvirtComputingResource
125125
// try to patch and SSH into the systemvm for up to 5 minutes
126126
for (int count = 0; count < 10; count++) {
127127
// wait and try passCmdLine for 30 seconds at most for CLOUDSTACK-2823
128-
libvirtComputingResource.passCmdLine(vmName, vmSpec.getBootArgs());
129-
// check router is up?
130-
final VirtualRoutingResource virtRouterResource = libvirtComputingResource.getVirtRouterResource();
128+
if (libvirtComputingResource.passCmdLine(vmName, vmSpec.getBootArgs())) {
129+
break;
130+
}
131+
}
132+
133+
final VirtualRoutingResource virtRouterResource = libvirtComputingResource.getVirtRouterResource();
134+
// check if the router is up?
135+
for (int count = 0; count < 60; count++) {
131136
final boolean result = virtRouterResource.connect(controlIp, 1, 5000);
132137
if (result) {
133138
break;

‎server/src/com/cloud/server/ConfigurationServerImpl.java‎

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,12 @@
1616
// under the License.
1717
package com.cloud.server;
1818

19-
import java.io.DataInputStream;
20-
import java.io.EOFException;
2119
import java.io.File;
2220
import java.io.FileInputStream;
2321
import java.io.FileNotFoundException;
2422
import java.io.FileOutputStream;
2523
import java.io.IOException;
24+
import java.nio.file.Files;
2625
import java.security.NoSuchAlgorithmException;
2726
import java.sql.PreparedStatement;
2827
import java.sql.ResultSet;
@@ -608,29 +607,23 @@ public void updateKeyPairs() {
608607
// FIXME: take a global database lock here for safety.
609608
boolean onWindows = isOnWindows();
610609
if(!onWindows) {
611-
Script.runSimpleBashScript("if [ -f " + privkeyfile + " ]; then rm -f " + privkeyfile + "; fi; ssh-keygen -t rsa -N '' -f " + privkeyfile + " -q");
610+
Script.runSimpleBashScript("if [ -f " + privkeyfile + " ]; then rm -f " + privkeyfile + "; fi; ssh-keygen -t rsa -m PEM -N '' -f " + privkeyfile + " -q 2>/dev/null || ssh-keygen -t rsa -N '' -f " + privkeyfile + " -q");
612611
}
613612

614-
byte[] arr1 = new byte[4094]; // configuration table column value size
615-
try (DataInputStream dis = new DataInputStream(new FileInputStream(privkeyfile))) {
616-
dis.readFully(arr1);
617-
} catch (EOFException e) {
618-
s_logger.info("[ignored] eof reached");
619-
} catch (Exception e) {
613+
final String privateKey;
614+
final String publicKey;
615+
try {
616+
privateKey = new String(Files.readAllBytes(privkeyfile.toPath()));
617+
} catch (IOException e) {
620618
s_logger.error("Cannot read the private key file", e);
621619
throw new CloudRuntimeException("Cannot read the private key file");
622620
}
623-
String privateKey = new String(arr1).trim();
624-
byte[] arr2 = new byte[4094]; // configuration table column value size
625-
try (DataInputStream dis = new DataInputStream(new FileInputStream(pubkeyfile))) {
626-
dis.readFully(arr2);
627-
} catch (EOFException e) {
628-
s_logger.info("[ignored] eof reached");
629-
} catch (Exception e) {
630-
s_logger.warn("Cannot read the public key file", e);
621+
try {
622+
publicKey = new String(Files.readAllBytes(pubkeyfile.toPath()));
623+
} catch (IOException e) {
624+
s_logger.error("Cannot read the public key file", e);
631625
throw new CloudRuntimeException("Cannot read the public key file");
632626
}
633-
String publicKey = new String(arr2).trim();
634627

635628
final String insertSql1 =
636629
"INSERT INTO `cloud`.`configuration` (category, instance, component, name, value, description) " +

‎services/console-proxy-rdp/rdpconsole/pom.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,17 @@
5252
<directory>${basedir}/src/test/resources</directory>
5353
</testResource>
5454
</testResources>
55+
<plugins>
56+
<plugin>
57+
<groupId>org.apache.maven.plugins</groupId>
58+
<artifactId>maven-surefire-plugin</artifactId>
59+
<configuration>
60+
<excludes>
61+
<exclude>rdpclient/MockServerTest.java</exclude>
62+
</excludes>
63+
</configuration>
64+
</plugin>
65+
</plugins>
5566
</build>
5667

5768
<dependencies>

‎systemvm/debian/opt/cloud/bin/setup/bootstrap.sh‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
#!/bin/bash
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
19+
PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
20+
CMDLINE=/var/cache/cloud/cmdline
21+
22+
. /lib/lsb/init-functions
23+
24+
log_it() {
25+
echo "$(date) $@" >> /var/log/cloud.log
26+
log_action_msg "$@"
27+
}
28+
29+
hypervisor() {
30+
if [ -d /proc/xen ]; then
31+
mount -t xenfs none /proc/xen
32+
$(dmesg | grep -q "Xen HVM")
33+
if [ $? -eq 0 ]; then # 1=PV,0=HVM
34+
echo "xen-hvm" && return 0
35+
else
36+
echo "xen-pv" && return 0
37+
fi
38+
fi
39+
40+
[ -x /usr/sbin/virt-what ] && local facts=( $(virt-what) )
41+
if [ "$facts" != "" ]; then
42+
# Xen HVM is recognized as Hyperv when Viridian extensions are enabled
43+
if [ "${facts[-1]}" == "xen-domU" ] && [ "${facts[0]}" == "hyperv" ]; then
44+
echo "xen-hvm" && return 0
45+
else
46+
echo ${facts[-1]} && return 0
47+
fi
48+
fi
49+
50+
grep -q QEMU /proc/cpuinfo && echo "kvm" && return 0
51+
grep -q QEMU /var/log/messages && echo "kvm" && return 0
52+
53+
vmware-checkvm &> /dev/null && echo "vmware" && return 0
54+
55+
echo "unknown" && return 1
56+
}
57+
58+
config_guest() {
59+
if [ "$HYPERVISOR" == "kvm" ]
60+
then
61+
# Configure hot-plug
62+
modprobe acpiphp || true
63+
modprobe pci_hotplug || true
64+
sed -i -e "/^s0:2345:respawn.*/d" /etc/inittab
65+
sed -i -e "/6:23:respawn/a\s0:2345:respawn:/sbin/getty -L 115200 ttyS0 vt102" /etc/inittab
66+
fi
67+
[ ! -d /proc/xen ] && sed -i 's/^vc/#vc/' /etc/inittab && telinit q
68+
[ -d /proc/xen ] && sed -i 's/^#vc/vc/' /etc/inittab && telinit q
69+
}
70+
71+
get_boot_params() {
72+
case $HYPERVISOR in
73+
xen-pv|xen-domU)
74+
cat /proc/cmdline > $CMDLINE
75+
sed -i "s/%/ /g" $CMDLINE
76+
;;
77+
xen-hvm)
78+
if [ ! -f /usr/bin/xenstore-read ]; then
79+
log_it "ERROR: xentools not installed, cannot found xenstore-read" && exit 5
80+
fi
81+
/usr/bin/xenstore-read vm-data/cloudstack/init > $CMDLINE
82+
sed -i "s/%/ /g" $CMDLINE
83+
;;
84+
kvm)
85+
systemctl enable --now qemu-guest-agent
86+
# Wait for $CMDLINE file to be written by the qemu-guest-agent
87+
for i in {1..60}; do
88+
if [ -s $CMDLINE ]; then
89+
log_it "Received a new non-empty cmdline file from qemu-guest-agent"
90+
break
91+
fi
92+
sleep 1
93+
done
94+
if [ ! -s $CMDLINE ]; then
95+
log_it "Failed to receive the cmdline file via the qemu-guest-agent"
96+
fi
97+
;;
98+
vmware)
99+
vmtoolsd --cmd 'machine.id.get' > $CMDLINE
100+
;;
101+
virtualpc|hyperv)
102+
# Hyper-V is recognized as virtualpc hypervisor type. Boot args are passed using KVP Daemon
103+
#waiting for the hv_kvp_daemon to start up
104+
#sleep need to fix the race condition of hv_kvp_daemon and cloud-early-config
105+
[ -f /usr/sbin/hv_kvp_daemon ] && /usr/sbin/hv_kvp_daemon
106+
sleep 5
107+
cp -f /var/opt/hyperv/.kvp_pool_0 $CMDLINE
108+
cat /dev/null > /var/opt/hyperv/.kvp_pool_0
109+
;;
110+
virtualbox)
111+
# Virtualbox is used to test the virtual router
112+
# get the commandline from a dmistring (yes, hacky!)
113+
dmidecode | grep cmdline | sed 's/^.*cmdline://' > $CMDLINE
114+
RV=$?
115+
if [ $RV -ne 0 ] ; then
116+
log_it "Failed to get cmdline from a virtualbox dmi property"
117+
fi
118+
;;
119+
esac
120+
}
121+
122+
get_systemvm_type() {
123+
export TYPE=$(grep -Po 'type=\K[a-zA-Z]*' $CMDLINE)
124+
}
125+
126+
127+
patch_systemvm() {
128+
local patchfile=$1
129+
local backupfolder="/tmp/.conf.backup"
130+
local logfile="/var/log/patchsystemvm.log"
131+
if [ -f /usr/local/cloud/systemvm/conf/cloud.jks ]; then
132+
rm -fr $backupfolder
133+
mkdir -p $backupfolder
134+
cp -r /usr/local/cloud/systemvm/conf/* $backupfolder/
135+
fi
136+
rm /usr/local/cloud/systemvm -rf
137+
mkdir -p /usr/local/cloud/systemvm
138+
echo "All" | unzip $patchfile -d /usr/local/cloud/systemvm >$logfile 2>&1
139+
find /usr/local/cloud/systemvm/ -name \*.sh | xargs chmod 555
140+
if [ -f $backupfolder/cloud.jks ]; then
141+
cp -r $backupfolder/* /usr/local/cloud/systemvm/conf/
142+
echo "Restored keystore file and certs using backup" >> $logfile
143+
fi
144+
rm -fr $backupfolder
145+
# Import global cacerts into 'cloud' service's keystore
146+
keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore /usr/local/cloud/systemvm/certs/realhostip.keystore -srcstorepass changeit -deststorepass vmops.com -noprompt || true
147+
return 0
148+
}
149+
150+
patch() {
151+
local PATCH_MOUNT=/media/cdrom
152+
local logfile="/var/log/patchsystemvm.log"
153+
if [ "$TYPE" == "consoleproxy" ] || [ "$TYPE" == "secstorage" ] && [ -f ${PATCH_MOUNT}/agent.zip ] && [ -f /var/cache/cloud/patch.required ]
154+
then
155+
echo "Patching systemvm for cloud service with mount=$PATCH_MOUNT for type=$TYPE" >> $logfile
156+
patch_systemvm ${PATCH_MOUNT}/agent.zip
157+
if [ $? -gt 0 ]
158+
then
159+
echo "Failed to apply patch systemvm\n" >> $logfile
160+
exit 1
161+
fi
162+
fi
163+
164+
rm -f /var/cache/cloud/patch.required
165+
chmod -x /etc/systemd/system/cloud*.service
166+
systemctl daemon-reload
167+
umount $PATCH_MOUNT || true
168+
169+
if [ -f /mnt/cmdline ]; then
170+
cat /mnt/cmdline > $CMDLINE
171+
fi
172+
return 0
173+
}
174+
175+
bootstrap() {
176+
log_it "Bootstrapping systemvm appliance"
177+
178+
export HYPERVISOR=$(hypervisor)
179+
[ $? -ne 0 ] && log_it "Failed to detect hypervisor type, bailing out of early init" && exit 10
180+
log_it "Detected that we are running inside $HYPERVISOR"
181+
182+
config_guest
183+
get_boot_params
184+
get_systemvm_type
185+
patch
186+
sync
187+
sysctl -p
188+
189+
log_it "Configuring systemvm type=$TYPE"
190+
if [ -f "/opt/cloud/bin/setup/$TYPE.sh" ]; then
191+
/opt/cloud/bin/setup/$TYPE.sh
192+
else
193+
/opt/cloud/bin/setup/default.sh
194+
fi
195+
log_it "Finished setting up systemvm"
196+
exit 0
197+
}
198+
199+
bootstrap

0 commit comments

Comments
 (0)